CVE-2026-77830: CleanTalk Anti-Spam XSS Vulnerability

CVE-2026-77830 Overview

CVE-2026-77830 is a Stored Cross-Site Scripting (XSS) vulnerability [CWE-79] in the Spam protection, Honeypot, Anti-Spam by CleanTalk plugin for WordPress. The flaw affects all plugin versions up to and including 6.86. It stems from insufficient input sanitization and output escaping in the Comment Content aria-label placeholder. Attackers deliver the payload through unauthenticated comment submissions, and the injected script executes for non-logged-in visitors who view the affected page. When comment moderation is enabled, a moderator must approve the comment before the payload propagates to other users.

Critical Impact
Unauthenticated attackers can inject arbitrary JavaScript that executes in the browsers of site visitors, enabling session theft, redirection, and defacement across sites running vulnerable versions of the CleanTalk plugin.

Affected Products

Spam protection, Honeypot, Anti-Spam by CleanTalk plugin for WordPress — all versions up to and including 6.86
Fixed in version 6.87 of the cleantalk-spam-protect plugin
WordPress sites with the plugin installed and comments enabled

Discovery Timeline

2026-09-05 - CVE-2026-77830 published to NVD
2026-09-08 - Last updated in NVD database

Technical Details for CVE-2026-77830

Vulnerability Analysis

The vulnerability resides in the CleanTalk plugin's contact encoder logic, specifically in lib/Cleantalk/Common/ContactsEncoder/ContactsEncoder.php and the related ApbctWP implementation. User-supplied comment content is rendered inside an aria-label attribute without adequate escaping. Because the plugin fails to sanitize input before storage and does not escape output when constructing the HTML attribute, an attacker-controlled string can break out of the attribute context and inject executable JavaScript.

The payload is stored persistently in the WordPress database as part of the comment record. When any non-logged-in visitor loads a page containing the malicious comment, the browser parses and executes the injected script under the site's origin. This enables cookie theft for non-authenticated sessions, forced redirects, phishing overlays, and drive-by download delivery.

Root Cause

The root cause is missing input sanitization and missing output escaping around the aria-label attribute used to render encoded comment content. The plugin trusts data that originated from an unauthenticated HTTP request and inserts it into an HTML attribute without applying esc_attr() or an equivalent escaping routine. This is a classic Improper Neutralization of Input During Web Page Generation weakness [CWE-79].

Attack Vector

An attacker submits a crafted comment through the standard WordPress comment form. No authentication is required to deliver the payload. If the target site auto-approves comments, the payload becomes live immediately. If moderation is enabled, a moderator with approval rights must publish the comment before it reaches other visitors. Once rendered, the script executes only for logged-out users viewing the page.

See the Wordfence Vulnerability Report and the WordPress Change Set 3677388 for technical details on the vulnerable code path and the applied fix.

Detection Methods for CVE-2026-77830

Indicators of Compromise

Comments in wp_comments containing HTML attribute-breaking characters such as ", >, or on*= event handlers within the comment body
Presence of <script>, javascript:, or encoded script payloads in stored comment rows
Outbound HTTP requests from visitor browsers to unfamiliar domains shortly after loading pages with public comments
CleanTalk plugin version at or below 6.86 reported by WordPress site health or plugin inventory

Detection Strategies

Query the WordPress database for comment_content values containing suspicious markup patterns and event handler attributes
Compare installed plugin versions against 6.87 across WordPress fleets to identify unpatched sites
Review web server logs for POST requests to wp-comments-post.php containing attribute-breaking payload fragments
Monitor client-side telemetry for anomalous script execution on pages that render comment sections

Monitoring Recommendations

Alert on new outbound domains contacted from browsers loading comment-heavy pages
Track spikes in comment submissions from a small set of source IPs targeting the WordPress comment endpoint
Enable file integrity monitoring on the cleantalk-spam-protect plugin directory to detect tampering
Forward WordPress and web server logs into a centralized data lake for correlation across sites

How to Mitigate CVE-2026-77830

Immediate Actions Required

Update the CleanTalk plugin to version 6.87 or later on every WordPress instance where it is installed
Audit existing comments for stored payloads and remove or sanitize any malicious entries
Enable comment moderation so that no comment is published without human review until patching is complete
Rotate any administrator or moderator credentials that may have interacted with attacker-controlled pages

Patch Information

The vendor released the fix in version 6.87 of the cleantalk-spam-protect plugin. The patch introduces proper escaping in the ContactsEncoder component. Review the WordPress Change Set 3677388 and the 6.86 to 6.87 diff for the exact code changes.

Workarounds

Temporarily disable the CleanTalk plugin until it can be updated to 6.87
Disable comments site-wide or on high-traffic pages if immediate patching is not possible
Deploy a web application firewall rule that blocks comment submissions containing HTML attribute-breaking characters or script tags
Add a Content Security Policy that restricts inline script execution on public-facing pages

bash

# Configuration example: update the CleanTalk plugin via WP-CLI
wp plugin update cleantalk-spam-protect --version=6.87
wp plugin list --name=cleantalk-spam-protect --fields=name,status,version